Hello, I am a Splunk newbie and I am having issues using this software. I have gone through documentation, but I still find it challenging. For instance, how does one modify the code that generates an existing search? I have a search alert called "Test" I can change what happens when the alert is triggered, but do not see how to modify the actually search code (for lack of a better word). I only see save As as Save is whited out. The person who worked with Splunk prior to me created a dashboard that listed servers and the number of times each server appears within a specified period. I would like to create an alert, where if a new server appears, an email alert is sent out if there are more than 100 lines (or logs generated for this particular server) within an hour period for this new server. Email configuration is fine and works as desired. Can someone guide me as to how to create such an alert? Is there a way to use the code that generates the Dashboard? Any assistance would be greatly appreciated. I have only been working with Splunk for 2 days. Thanks in advance! Mark
... View more